CrowdStrike Warns of Two Extortion Crews Using Scattered Spider Tactics
Summary
CrowdStrike says Cordial Spider and Snarky Spider use voice phishing and social engineering to access identity platforms, steal data across victims’ SaaS environments and extort U.S. organizations.
Key points
- CrowdStrike says it has tracked Cordial Spider and Snarky Spider activity since at least October 2025, targeting U.S. organizations across sectors including academia, aviation, retail, finance and technology.
- The groups reportedly use calls, texts and emails to direct employees to phishing pages impersonating employer or identity-provider sign-in pages.
- The pages can capture credentials, session keys or tokens, enabling access across victims’ SaaS environments.
- Attackers reportedly add or remove MFA devices and delete emails and alerts that could warn organizations of suspicious activity.
- CrowdStrike says the groups use residential proxy networks to evade IP-based detection, and have distinct operating patterns, phishing infrastructure and leak sites.
- Some victims that did not pay extortion demands reportedly faced DDoS attacks; Snarky Spider has also used swatting and other harassment.
- CrowdStrike says the groups share tactics and objectives with Scattered Spider but have not demonstrated the same technical sophistication; the number of victims is unclear.
Article Details
- Event Type
- Voice-phishing and social-engineering-led identity compromise, SaaS data theft, and extortion campaigns
- Impact
- Cordial Spider and Snarky Spider reportedly compromise victims’ identity platforms, manipulate MFA, delete security alerts, and move through connected SaaS environments to steal data for extortion. Some victims who do not pay have reportedly faced DDoS attacks, and Snarky Spider has used swatting and other harassment. CrowdStrike said the scope of victimization is difficult to determine because a breach can expose data across connected services.
MITRE ATT&CK
T1070.008 · Clear Mailbox DataAttackers reportedly delete emails and other alerts that could warn victims of malicious activity.T1098.005 · Device RegistrationAttackers reportedly remove and establish MFA devices on compromised accounts.T1566.004 · Spearphishing VoiceThe groups reportedly use voice calls to direct targeted employees to phishing pages.
People
Threat Actors
BlackFileUnit 42 tracking name for Cordial Spider, which is reported to conduct identity-platform compromises and data-theft extortion campaigns.Cordial SpiderCrowdStrike tracks this financially motivated group, which reportedly uses voice-phishing and social engineering to compromise identity platforms and steal data for extortion. Unit 42 also tracks it as CL-CRI-1116 and UNC6671.Scattered SpiderCrowdStrike’s Adam Meyers described Cordial Spider and Snarky Spider as closely aligned with Scattered Spider and said they have adopted parts of its playbook; he said they have not demonstrated the same technical sophistication.SNARKY SPIDERCrowdStrike tracks this financially motivated group, which reportedly uses voice-phishing and social engineering to compromise identity platforms and steal data for extortion; it has also reportedly used swatting and other harassment against victims.UNC6671Unit 42 tracking name for Cordial Spider, which is reported to conduct identity-platform compromises and data-theft extortion campaigns.
Vendors
CrowdStrikeCybersecurity firm CrowdStrike warns that Cordial Spider and Snarky Spider, affiliates of The Com and linked to Scattered Spider, are using voiceâphishing and social engineering to compromise identity platforms andPalo Alto NetworksCrowdStrike’s warning closely follows research Palo Alto Networks’ Unit 42 and the Retail & Hospitality Information Sharing and Analysis Center shared last week about Cordial Spider’s string of attacks targeting
Countries
Industries
Academiaorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Automotiveorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Aviationorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Financial Servicestarget U.S.-based organizations in the academic, aviation, retail, hospitality, automotive, financial services, legal and technology sectors.Hospitalityorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Legalorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Retailorganizations across academia, aviation, retail, hospitality, automotive, finance, legal, and tech.Technologyorganizations in the academic, aviation, retail, hospitality, automotive, financial services, legal and technology sectors.